Network defense system and method thereof

Patent metadata

Field	Value
Publication number	US-11050770-B2
Application number	US-201816053279-A
Country	US
Kind code	B2
Filing date	Aug 2, 2018
Priority date	Aug 2, 2018
Publication date	Jun 29, 2021
Grant date	Jun 29, 2021

Abstract

A network defense system can include a sensor alert ingestion framework adapted to monitor network activity and alert detected or suspected anomalies. A network analyzer may be coupled to the sensor alert ingestion framework to analyze the anomalies. A course of action (CoA) simulator may be coupled to the network analyzer adapted to generate a list of decision including courses of action to address the anomalies. There may be a training and feedback unit coupled to the CoA simulator to train the system to improve responses in addressing future anomalies.

First claim

The invention claimed is:

1. A method for network defense comprising:
detecting anomalies in network traffic activity with anomaly detectors in a network defense system;
analyzing the detected anomalies to determine a likelihood that network traffic conditions align with network states and suggesting a corrective action based on a current network state;
generating a list of decisions including courses of action to address the anomalies and effecting an execution of at least one course of action;
evaluating, quantitatively and qualitatively, the courses of actions in an automated manner using parallel simulations to rank the courses of actions in the list of decisions before effecting the execution of at least one course of action;
training a system to improve responses in addressing future anomalies in network traffic activity; and
adjusting future executions of courses of action based, at least in part, on training and updating rules via experience gained by making exploratory decisions and execution exploratory course of actions.

2. The method for network defense of claim 1 , further comprising:
shaping network traffic in response to the execution of the at least one course of action.

3. The method for network defense of claim 1 , further comprising:
dropping at least one packet of information exchanged across a communication link between nodes in the network in response to the execution of the at least one course of action.

4. The method for network defense of claim 1 , further comprising:
autonomically executing the at least one course of action.

5. The method for network defense of claim 1 , further comprising:
evolving, in a traffic modeler, operational traffic models based on observed traffic;
simulating and estimating, in a decision engine coupled with the traffic modeler, effects of available courses of actions;
changing a network traffic model based on the simulated and estimated courses of actions;
comparing the network traffic model to archived models; and
removing the anomalies to return network traffic to a normal or recovering state.

6. The method for network defense of claim 1 , further comprising:
suggesting a course of action from the courses of action;
estimating future impact on the network of applying the suggested course of action;
analyzing, via a rule-based engine applying model-based reasoning, a severity of suspected adversarial behavior; and
comparing information about a current state of the network against rules and policies, and then suggesting what course of action to take in response to the information in different situations.

7. The method for network defense of claim 1 , further comprising:
determining a presence of an alert of the anomaly in the network relative to a fact;
triggering a rule in response to the fact;
executing at least one course of action in response to the rule being triggered;
providing the courses of actions to a network simulator for impact evaluation; and
evaluating an impact of the course of action on the network.

8. The method for network defense of claim 7 , further comprising:
providing quantifiable evidence that applying one course of action addresses at least one anomaly;
quantifying whether a course of action will reduce network performance and whether the course of action will impact future performance; and
predicting future consequences of network traffic activity on the network for the course of action.

9. A system for defending a monitored network, the system comprising:
at least one non-transitory computer readable storage medium, in operative communication with the system, having at least one set of instructions encoded thereon that, when executed by at least one processor, performs operations to perform network defense, and the instructions including:
detecting anomalies in network traffic activity with anomaly detectors in the network defense system;
analyzing the detected anomalies to determine a likelihood that network traffic conditions align with network states and suggesting a corrective action based on a current network state;
generating a list of decisions including courses of action to address the anomalies and effecting an execution of at least one course of action;
evaluating, quantitatively and qualitatively, the courses of actions in an automated manner using parallel simulations to rank the courses of actions in the list of decisions before effecting the execution of at least one course of action;
training a system to improve responses in addressing future anomalies in network traffic activity;
autonomously adjusting future executions of courses of action based, at least in part, on training and updating rules via experience gained by making exploratory decisions and execution exploratory course of actions without human administration; and
shaping network traffic in response to the execution of the at least one course of action.

10. The system for defending a monitored network of claim 9 , wherein the instructions further comprise:
dropping at least one packet of information exchanged across a communication link between nodes in the network in response to the execution of the at least one course of action.

11. The system for defending a monitored network of claim 9 , wherein the instructions further comprise:
autonomically executing the at least one course of action.

12. The system for defending a monitored network of claim 9 , wherein the instructions further comprise:
evolving, in a traffic modeler, operational traffic models based on observed traffic;
simulating and estimating, in a decision engine coupled with the traffic modeler, effects of available courses of actions;
changing a network traffic model based on the simulated and estimated courses of actions;
comparing the network traffic model to archived models; and
removing the anomalies to return network traffic to a normal or recovering state.

13. The system for defending a monitored network of claim 9 , wherein the instructions further comprise:
suggesting a course of action from the courses of action;
estimating future impact on the network of applying the suggested course of action;
analyzing, via a rule-based engine applying model-based reasoning, a severity of suspected adversarial behavior; and
comparing information about a current state of the network against rules and policies, and then suggesting what course of action to take in response to the information in different situations.

14. The system for defending a monitored network of claim 9 , wherein the instructions further comprise:
determining a presence of an alert of the anomaly in the network relative to a fact;
triggering a rule in response to the fact;
executing at least one course of action in response to the rule being triggered;
providing the courses of actions to a network simulator for impact evaluation; and
evaluating an impact of the course of action on the network.

15. The system for defending a monitored network of claim 9 , wherein the instructions further comprise:
providing quantifiable evidence that applying one course of action addresses at least one anomaly;
quantifying whether a course of action will reduce network performance and whether the course of action will impact future performance; and
predicting future consequences of network traffic activity on the network for the course of action.

16. A computer program product including one or more non-transitory machine-readable mediums encoded with instructions that when executed by one or more processors cause a process to be carried out

Assignees

• Bae Sys Inf & Elect Sys Integ

Inventors

• Nanda Soumendra
• Cathey Rebecca
• Clough Jr Lawrence A
• Conway Adrian E
• Liu Fang

Classifications

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06N5/046

  Forward inferencing; Production systems · CPC title

• G06N3/006

  based on simulated virtual individual or collective life forms, e.g. social simulations or particle swarm optimisation [PSO] · CPC title

• H04L63/0263

  Rule management · CPC title